Data recovery method and data recovery system

Abstract

When the latest data and a backup of the latest data are infected, the data is recovered from the backup older than the data. Therefore, it is necessary to eliminate a difference from the latest data, leading to loss of business opportunities. A data recovery system that recovers data stored in a storage system includes a storage device that holds original data, an analyzing server that holds a copy of the original data, and generates formatted data by formatting the copy data for analysis, a managing server that holds the copy data and data history management information storing a history of the formatted data, and a data recovery unit that refers to the data history management information, selects the copy data or the formatted data as recovery data, and recovers the data from the selected recovery data when a security threat is detected in the data.

What is claimed is: 
     
         1 . A data recovery method for recovering data stored in a storage system,
 the data recovery method comprising:   causing a storage device to hold original data;   causing an analyzing server including a data analyzing unit to hold copy data that is a copy of the original data, and generate formatted data obtained by formatting the copy data for analysis;   causing a managing server to hold the copy data and data history management information storing a history of the formatted data; and   causing a data recovery unit to refer to the data history management information, select the copy data or the formatted data as recovery data, and recover the data from the selected recovery data when a security threat is detected in the data.   
     
     
         2 . The data recovery method according to  claim 1 , wherein it is determined that the security threat is detected when an error occurs in a process of formatting the data or a process of analyzing the data. 
     
     
         3 . The data recovery method according to  claim 1 , wherein
 the data history management information includes flag information indicating that data processed without an error is normal, and   the data recovery unit uses, as the recovery data, data for which the flag information indicates normal.   
     
     
         4 . The data recovery method according to  claim 2 , wherein
 the storage device performs a backup process of backing up data to other storage,   the data history management information includes time information indicating a time when the data is processed, and   the data recovery unit selects data as the recovery data based on time information indicating a time when a copy process and the backup process are performed.   
     
     
         5 . The data recovery method according to  claim 1 , wherein
 process types of the data history management information include types of copy, formatting, and analysis, and   the data recovery unit selects data as the recovery data in order of copying, formatting, and analysis.   
     
     
         6 . The data recovery method according to  claim 5 , wherein
 the data history management information includes similarity information indicating a difference from the unprocessed data,   when a process type of the data history management information is formatting or analysis, an output unit outputs a similarity of the selected data, and   when an input unit receives information indicating approval of use of the selected recovery data, the data recovery unit uses the selected data as the recovery data.   
     
     
         7 . A data recovery system that recovers data stored in a storage system, the data recovery system comprising:
 a storage device that holds original data;   an analyzing server that holds copy data that is a copy of the original data, and generates formatted data obtained by formatting the copy data for analysis;   a managing server that holds the copy data and data history management information storing a history of the formatted data; and   a data recovery unit that refers to the data history   management information, selects the copy data or the formatted data as recovery data, and recovers the data from the selected recovery data when a security threat is detected in the data.